An email header is metadata associated with a message, separate from its main content. It can include sender and recipient fields, timestamps, message identifiers, and routing details added as the message passes through mail servers. Lines such as “Received” can help show the path a message took, though headers may be incomplete or misleading.
Headers matter in cybersecurity because investigators and email operators use them to assess suspicious messages, trace delivery paths, and compare message details with server logs. In phishing investigations, headers can provide clues about the systems involved, but they do not alone prove who authored or controlled a message. Defenders should preserve original messages and examine headers alongside mail-flow logs and other evidence.